Use a secret manager?Cert is a secret, add a small agent to your containers that pings your secret manager and gets back the current cert. Then saves / imports it (or whatever is appropriate).
60% Local; 30% All; 10% Subscribed (still building out my subscribed list)